Advances in the capabilities of portable communication devices have allowed portable communication devices such as smart phones to be used as payment instruments to conduct contactless transactions. For example, a portable communication device can be placed in proximity to an access device such as a point-of-sale (POS) terminal to transfer account information from the portable communication device to the access device to conduct a transaction. To provide a secure operating environment to securely store account information on a portable communication device, a secure element such as subscriber identity module (SIM) card, specialized integrated chip embedded into the portable communication device, or specialized component provided as aftermarket solution is used. At the time of a transaction, the secure element communicates directly with a contactless interface (e.g., a near-field communication (NFC) transceiver) of the portable communication device to pass payment data to a contactless reader of the access device. A secure element is considered secure because account information is stored in tamper-resistant hardware, which protects the account information from malware or viruses that may have infected the operating system or an application running on the portable communication device.
However, a secure element used in a portable communication device is typically not under the control of a financial institution, but is instead under the control of a mobile network operator (MNO). As a result, an issuer and/or payment processor may not have direct access to a secure element to provision it with account credentials and payment functionalities. In order to gain access to a secure element, an issuer and/or payment processor may have to establish commercial agreements and technical connectivity with the party controlling the secure element to perform over-the-air (OTA) personalization of the secure element. This is both a cumbersome and complex process. Furthermore, incorporating a secure element adds to the manufacturing cost of the portable communication device, and increases the cost of the finished portable communication device.
Thus, in some cases, it would be desirable to use a portable communication device that does not have a secure element to make payments. Or, if the portable communication device does have a secure element, it may be desirable not to rely on the use of the secure element. However, because a secure element is not used, transaction security will be a concern.
Embodiments of the present invention address these and other problems individually and collectively. Specifically, embodiments of the invention address the problem of security concerns with conducting transactions with a portable communication device that does not have or does not rely on a secure element.